@astrale-os/adapter-cloudflare 0.5.0-beta.71 → 0.5.0-beta.73

package/dist/development/worker-output.js

@@ -0,0 +1,25 @@
+const READY_RE = /(?:Ready on|Listening on|⎔.*?at)\s+(https?:\/\/[^\s]+)/iu;
+/** Admit the local Worker origin printed by Wrangler and ignore its inspector endpoints. */
+export function parseWorkerReadyUrl(text, port) {
+    const ready = READY_RE.exec(text);
+    if (ready !== null)
+        return normalizeLocal(ready[1], port);
+    const localhostOnPort = new RegExp(`(https?://(?:localhost|127\\.0\\.0\\.1):${port})(?![0-9])`, 'iu');
+    const match = localhostOnPort.exec(text);
+    return match === null ? undefined : normalizeLocal(match[1], port);
+}
+function normalizeLocal(input, port) {
+    try {
+        const url = new URL(input);
+        if (url.hostname === '0.0.0.0')
+            url.hostname = '127.0.0.1';
+        if (url.hostname === 'localhost')
+            url.hostname = '127.0.0.1';
+        if (url.port === '')
+            url.port = String(port);
+        return url.origin;
+    }
+    catch {
+        return `http://127.0.0.1:${port}`;
+    }
+}

package/dist/{build/wrangler/development.d.ts → development/worker.d.ts}

@@ -1,8 +1,9 @@
-export interface DevHandle {
-    url: string;
+export interface WorkerHandle {
+    readonly url: string;
+    readonly finished: Promise<void>;
     stop(): Promise<void>;
 }
-export declare function runWranglerDev(args: {
+export declare function startWorker(args: {
     projectDir: string;
     configPath: string;
     port: number;
@@ -12,6 +13,5 @@ export declare function runWranglerDev(args: {
     /** Pin ordinary local requests to one stable issuer after the final port is selected. */
     readonly pinLocalOrigin?: boolean;
     readonly secrets: Readonly<Record<string, string>>;
-    readonly onReload: () => void;
     readonly onLog?: (line: string) => void;
-}): Promise<DevHandle>;
+}): Promise<WorkerHandle>;

package/dist/{build/wrangler/development.js → development/worker.js}

@@ -1,10 +1,10 @@
 import { spawn } from 'node:child_process';
 import { createServer } from 'node:net';
-import { parseDevReadyUrl } from '../parse-output.js';
-import { stopChild, wranglerCommand, wranglerProcessEnv } from './process.js';
-import { createSecretEnvironment, secretRedactor } from './secrets.js';
-import { runWranglerTypes } from './type-generation.js';
-export async function runWranglerDev(args) {
+import { stopChild, wranglerCommand, wranglerProcessEnv } from '../wrangler/process.js';
+import { createSecretEnvironment, secretRedactor } from '../wrangler/secrets.js';
+import { runWranglerTypes } from '../wrangler/type-generation.js';
+import { parseWorkerReadyUrl } from './worker-output.js';
+export async function startWorker(args) {
     await runWranglerTypes(args);
     const { cmd, prefix } = wranglerCommand(args.projectDir);
     const bindHost = args.ip ?? '127.0.0.1';
@@ -60,15 +60,12 @@ export async function runWranglerDev(args) {
                     buildErrorTail = (buildErrorTail + text).slice(-2000);
                 }
                 if (!resolved) {
-                    const ready = parseDevReadyUrl(text, args.port);
+                    const ready = parseWorkerReadyUrl(text, args.port);
                     if (ready) {
                         resolved = true;
                         resolve(ready);
                     }
                 }
-                else if (/Reloading|Detected changes|Updated/i.test(text)) {
-                    args.onReload();
-                }
             };
             child.stdout?.on('data', onData);
             child.stderr?.on('data', onData);
@@ -88,11 +85,10 @@ export async function runWranglerDev(args) {
                 if (!resolved && child.exitCode === null) {
                     resolved = true;
                     if (buildErrorTail) {
-                        void stopChild(child);
                         reject(new Error(`worker build failed — the dev server would hang silently.\n${buildErrorTail}`));
                     }
                     else {
-                        resolve(fallbackUrl);
+                        reject(new Error(`wrangler dev did not report local readiness at ${fallbackUrl}.\n${outputTail}`));
                     }
                 }
             }, 15_000).unref?.();
@@ -103,9 +99,24 @@ export async function runWranglerDev(args) {
         await secretEnvironment?.remove();
         throw cause;
     }
-    return {
+    let stopping = false;
+    const finished = new Promise((resolve, reject) => {
+        child.once('exit', (code, signal) => {
+            if (stopping)
+                resolve();
+            else {
+                reject(new Error(`wrangler dev stopped unexpectedly (code ${code ?? 'null'}, signal ${signal ?? 'none'}).\n${outputTail}`));
+            }
+        });
+        child.once('error', reject);
+    });
+    return Object.freeze({
         url: args.pinLocalOrigin ? fallbackUrl : url,
+        finished,
         async stop() {
+            if (stopping)
+                return finished;
+            stopping = true;
             try {
                 await stopChild(child);
             }
@@ -113,7 +124,7 @@ export async function runWranglerDev(args) {
                 await secretEnvironment?.remove();
             }
         },
-    };
+    });
 }
 function portFree(port, host) {
     return new Promise((resolve) => {

package/dist/identity/source.js

@@ -1,5 +1,6 @@
+import { randomUUID } from 'node:crypto';
 import { existsSync } from 'node:fs';
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { link, mkdir, open, readFile, unlink } from 'node:fs/promises';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { SIGNING_IDENTITY_BINDING } from './binding.js';
 import { admitSigningIdentity, createSigningIdentity } from './material.js';
@@ -41,10 +42,10 @@ export async function localSigningIdentity(projectDir, declaration, origin) {
 }
 async function generateIdentity(path) {
     const value = await createSigningIdentity();
-    await mkdir(dirname(path), { recursive: true });
-    await writeFile(path, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
-    process.stderr.write(`\x1b[33m!\x1b[0m new signing identity generated at .astrale/identity.json (kid ${value.kid}).\n` +
-        `  Retain it in managed secret storage before deploying; remote deploy fails closed without an explicit identity file.\n`);
+    if (await installIdentity(path, value)) {
+        process.stderr.write(`\x1b[33m!\x1b[0m new signing identity generated at .astrale/identity.json (kid ${value.kid}).\n` +
+            `  Retain it in managed secret storage before deploying; remote deploy fails closed without an explicit identity file.\n`);
+    }
 }
 async function migrateLegacyIdentity(legacy, destination, origin) {
     const source = await readFile(legacy, 'utf8');
@@ -59,9 +60,37 @@ async function migrateLegacyIdentity(legacy, destination, origin) {
         throw invalidIdentity(legacy, cause);
     }
     const value = await admitSigningIdentity(decoded, legacy, `${origin}-key`);
-    await mkdir(dirname(destination), { recursive: true });
-    await writeFile(destination, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
-    process.stderr.write(`\x1b[33m!\x1b[0m migrated .astrale/identity.ts to secret-backed .astrale/identity.json (kid ${value.kid}).\n`);
+    if (await installIdentity(destination, value)) {
+        process.stderr.write(`\x1b[33m!\x1b[0m migrated .astrale/identity.ts to secret-backed .astrale/identity.json (kid ${value.kid}).\n`);
+    }
+}
+/** Publish a complete owner-only identity once; concurrent environments reuse the winner. */
+async function installIdentity(path, value) {
+    await mkdir(dirname(path), { recursive: true });
+    const staging = `${path}.${process.pid}.${randomUUID()}.next`;
+    const file = await open(staging, 'wx', 0o600);
+    try {
+        await file.writeFile(`${JSON.stringify(value, null, 2)}\n`, 'utf8');
+        await file.sync();
+    }
+    catch (cause) {
+        await file.close();
+        await unlink(staging).catch(() => undefined);
+        throw cause;
+    }
+    await file.close();
+    try {
+        await link(staging, path);
+        return true;
+    }
+    catch (cause) {
+        if (!(cause instanceof Error && 'code' in cause && cause.code === 'EEXIST'))
+            throw cause;
+        return false;
+    }
+    finally {
+        await unlink(staging).catch(() => undefined);
+    }
 }
 async function readSource(path, declaration) {
     let source;

package/dist/index.d.ts

@@ -9,7 +9,8 @@
  *     prod: { route: 'crm.acme.dev', secrets: '.env.prod', signingIdentity: '.astrale/identity.json' },
  *   })
  *
- * `dev` runs `wrangler dev` locally; an env with no `route` ships to
+ * `dev` runs the Worker and optional Vite frontend on allocated local ports;
+ * an env with no `route` ships to
  * `*.workers.dev`; an env with a `route` ships to that custom domain.
  *
  * Prefer a managed deploy (no Cloudflare account)? Use

package/dist/index.js

@@ -9,7 +9,8 @@
  *     prod: { route: 'crm.acme.dev', secrets: '.env.prod', signingIdentity: '.astrale/identity.json' },
  *   })
  *
- * `dev` runs `wrangler dev` locally; an env with no `route` ships to
+ * `dev` runs the Worker and optional Vite frontend on allocated local ports;
+ * an env with no `route` ships to
  * `*.workers.dev`; an env with a `route` ships to that custom domain.
  *
  * Prefer a managed deploy (no Cloudflare account)? Use

package/dist/params.d.ts

@@ -6,7 +6,7 @@
  * is `Record<string, CloudflareParams>`.
  *
  * Three deployment shapes fall out of which fields are set:
- *   • dev (local)      — `watch()` runs `wrangler dev`; URL = http://localhost:<port>
+ *   • dev (local)      — `develop()` runs `wrangler dev`; URL = an allocated loopback port
  *   • dev-remote       — `deploy()` with no `route`; URL = https://<name>.<sub>.workers.dev
  *   • remote (custom)  — `deploy()` with `route`; URL = https://<route>
  */
@@ -29,11 +29,11 @@ export interface CloudflareParams {
     /**
      * Private Ed25519 JWK file retained outside source control. Remote deploys
      * require this explicit source so a fresh runner cannot silently rotate an
-     * installed Domain identity. Local watch generates `.astrale/identity.json`
+     * installed Domain identity. Local development generates `.astrale/identity.json`
      * once when this field is omitted.
      */
     readonly signingIdentity?: string;
-    /** Local dev port for `wrangler dev`. Default 8787. */
+    /** Strict local development port. Omit to allocate an available loopback port. */
     readonly port?: number;
     /**
      * Public URL the dev server is reached through (tunnel / sandbox preview /

package/dist/{build/wrangler → wrangler}/bundle.js

@@ -1,9 +1,7 @@
 import { readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { runCapture, wranglerCommand } from './process.js';
-import { runWranglerTypes } from './type-generation.js';
 export async function runWranglerBundle(args) {
-    await runWranglerTypes(args);
     const { cmd, prefix } = wranglerCommand(args.projectDir);
     const { code, out } = await runCapture(cmd, [
         ...prefix,

package/dist/{build/wrangler → wrangler}/deploy.js

@@ -1,4 +1,4 @@
-import { parseDeployUrl, parseDeployVersionId } from '../parse-output.js';
+import { parseDeployUrl, parseDeployVersionId } from '../deploy/output.js';
 import { runCapture, wranglerCommand } from './process.js';
 import { secretRedactor, withSecretsFile } from './secrets.js';
 import { runWranglerTypes } from './type-generation.js';

package/dist/wrangler/index.d.ts

@@ -0,0 +1,5 @@
+export { runWranglerBundle } from './bundle.js';
+export { runWranglerDeploy, WranglerDeployError, type DeployArgs } from './deploy.js';
+export { wranglerProcessEnv } from './process.js';
+export { admitWranglerDeploymentStatus, runWranglerDeploymentStatus, type WranglerDeploymentStatus, } from './status.js';
+export { runWranglerTypes } from './type-generation.js';

package/dist/wrangler/index.js

@@ -0,0 +1,5 @@
+export { runWranglerBundle } from './bundle.js';
+export { runWranglerDeploy, WranglerDeployError } from './deploy.js';
+export { wranglerProcessEnv } from './process.js';
+export { admitWranglerDeploymentStatus, runWranglerDeploymentStatus, } from './status.js';
+export { runWranglerTypes } from './type-generation.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/adapter-cloudflare",
-  "version": "0.5.0-beta.71",
+  "version": "0.5.0-beta.73",
   "description": "Deploy an Astrale application through Cloudflare Workers",
   "keywords": [
     "adapter",
@@ -49,7 +49,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@astrale-os/sdk": "0.5.0-beta.68",
+    "@astrale-os/sdk": "0.5.0-beta.70",
     "@noble/hashes": "2.3.0",
     "hono": "^4.6.20",
     "jose": "^6.1.3",

package/template/astrale.config.ts

@@ -7,9 +7,8 @@
  *
  * This variant deploys to YOUR OWN Cloudflare account (the `cloudflare` adapter).
  *
- *   pnpm dev                       # wrangler dev → prints a local URL
- *   astrale domain install <url> --direct # mount the dev URL on an instance
- *   pnpm prod                      # deploy to your Cloudflare account
+ *   pnpm dev   # local Worker + Vite HMR on allocated ports
+ *   pnpm prod  # deploy to your Cloudflare account
  */
 import { cloudflare } from '@astrale-os/adapter-cloudflare'
 import { deploy, runtime } from '@astrale-os/sdk/deployment'
@@ -19,8 +18,8 @@ import { deploy, runtime } from '@astrale-os/sdk/deployment'
 //
 //   import { astrale } from '@astrale-os/adapter-astrale'
 //   export default deploy({ application, entrypoint: runtime('./runtime.ts'), adapter: astrale({
-//     dev: { secrets: '.env.dev' },               // local wrangler dev
-//     prod: { instance: '<your-instance-slug>' }, // managed deploy
+//     dev: { secrets: '.env.dev' },               // tunnel + install + View
+//     prod: { instance: '<your-instance-slug>' }, // managed deploy + install
 //   }) })
 
 import { application } from './application.js'
@@ -29,7 +28,8 @@ export default deploy({
   application,
   entrypoint: runtime('./runtime.ts'),
   adapter: cloudflare({
-    // Local dev: `wrangler dev`. No route → URL is http://localhost:8787.
+    // Local dev: allocated Worker/Vite ports, one Worker-facing URL, and HMR.
+    // Supply `pnpm dev --host <origin> --port <port>` for ingress you own.
     dev: { secrets: '.env.dev' },
     // Custom-domain prod. Drop `route` to ship to *.workers.dev instead.
     // The scaffold creates this identity once. Retain it in managed secret

package/dist/build/parse-output.d.ts

@@ -1,26 +0,0 @@
-/**
- * Pure parsers for `wrangler` stdout. Kept separate from the process-spawning in
- * `wrangler-cli.ts` so the brittle bit — scraping wrangler's human output — is
- * unit-testable against captured fixtures without shelling out.
- */
-/**
- * Local dev URL from `wrangler dev` output, normalized to an origin on the given
- * port. Returns `undefined` when the output hasn't reported readiness yet.
- *
- * The fallback (when no explicit "Ready on" line) only accepts a localhost URL
- * on the EXPECTED port — wrangler may print unrelated localhost URLs (e.g. an
- * inspector/devtools endpoint on a different port) before readiness, and taking
- * one of those would point `astrale domain install <url>` at a dead endpoint.
- */
-export declare function parseDevReadyUrl(text: string, port: number): string | undefined;
-/**
- * Authoritative public URL from `wrangler deploy` output. A custom-domain
- * `route` wins (the deploy attaches it); otherwise the printed `*.workers.dev`
- * URL. Returns `undefined` when neither is available (caller surfaces the raw
- * output).
- */
-export declare function parseDeployUrl(text: string, route?: string): string | undefined;
-/** Cloudflare version published by the final Wrangler deploy pass. */
-export declare function parseDeployVersionId(text: string): string | undefined;
-/** Normalize a local dev URL to an origin: `0.0.0.0` → `localhost`, fill the port. */
-export declare function normalizeLocal(url: string, port: number): string;

package/dist/build/parse-output.js

@@ -1,57 +0,0 @@
-/**
- * Pure parsers for `wrangler` stdout. Kept separate from the process-spawning in
- * `wrangler-cli.ts` so the brittle bit — scraping wrangler's human output — is
- * unit-testable against captured fixtures without shelling out.
- */
-const READY_RE = /(?:Ready on|Listening on|⎔.*?at)\s+(https?:\/\/[^\s]+)/i;
-const WORKERS_DEV_RE = /(https:\/\/[^\s]+\.workers\.dev)/i;
-const VERSION_ID_RE = /(?:Current\s+)?Version ID:\s*([a-z0-9_-]+)/i;
-/**
- * Local dev URL from `wrangler dev` output, normalized to an origin on the given
- * port. Returns `undefined` when the output hasn't reported readiness yet.
- *
- * The fallback (when no explicit "Ready on" line) only accepts a localhost URL
- * on the EXPECTED port — wrangler may print unrelated localhost URLs (e.g. an
- * inspector/devtools endpoint on a different port) before readiness, and taking
- * one of those would point `astrale domain install <url>` at a dead endpoint.
- */
-export function parseDevReadyUrl(text, port) {
-    const ready = READY_RE.exec(text);
-    if (ready)
-        return normalizeLocal(ready[1], port);
-    // `port` is a number, so it's safe to interpolate into the pattern. The
-    // negative lookahead stops `:8787` from matching inside `:87870`.
-    const localhostOnPort = new RegExp(`(https?://(?:localhost|127\\.0\\.0\\.1):${port})(?![0-9])`, 'i');
-    const m = localhostOnPort.exec(text);
-    return m ? normalizeLocal(m[1], port) : undefined;
-}
-/**
- * Authoritative public URL from `wrangler deploy` output. A custom-domain
- * `route` wins (the deploy attaches it); otherwise the printed `*.workers.dev`
- * URL. Returns `undefined` when neither is available (caller surfaces the raw
- * output).
- */
-export function parseDeployUrl(text, route) {
-    if (route)
-        return `https://${route.replace(/\/.*$/, '')}`;
-    const m = WORKERS_DEV_RE.exec(text);
-    return m ? m[1] : undefined;
-}
-/** Cloudflare version published by the final Wrangler deploy pass. */
-export function parseDeployVersionId(text) {
-    return VERSION_ID_RE.exec(text)?.[1];
-}
-/** Normalize a local dev URL to an origin: `0.0.0.0` → `localhost`, fill the port. */
-export function normalizeLocal(url, port) {
-    try {
-        const u = new URL(url);
-        if (u.hostname === '0.0.0.0')
-            u.hostname = 'localhost';
-        if (!u.port)
-            u.port = String(port);
-        return u.origin;
-    }
-    catch {
-        return `http://localhost:${port}`;
-    }
-}

package/dist/build/wrangler-cli.d.ts

@@ -1,6 +0,0 @@
-export { runWranglerBundle } from './wrangler/bundle.js';
-export { runWranglerDeploy, WranglerDeployError, type DeployArgs } from './wrangler/deploy.js';
-export { runWranglerDev, type DevHandle } from './wrangler/development.js';
-export { wranglerProcessEnv } from './wrangler/process.js';
-export { admitWranglerDeploymentStatus, runWranglerDeploymentStatus, type WranglerDeploymentStatus, } from './wrangler/status.js';
-export { runWranglerTypes } from './wrangler/type-generation.js';

package/dist/build/wrangler-cli.js

@@ -1,6 +0,0 @@
-export { runWranglerBundle } from './wrangler/bundle.js';
-export { runWranglerDeploy, WranglerDeployError } from './wrangler/deploy.js';
-export { runWranglerDev } from './wrangler/development.js';
-export { wranglerProcessEnv } from './wrangler/process.js';
-export { admitWranglerDeploymentStatus, runWranglerDeploymentStatus, } from './wrangler/status.js';
-export { runWranglerTypes } from './wrangler/type-generation.js';